Development discussion of WireGuard
 help / color / mirror / Atom feed
* WireGuard protocol blocking in China, swgp-go (userspace obfuscation proxy)
@ 2022-06-09 22:05 David Fifield
  2022-06-14 13:13 ` Nico Schottelius
  2022-06-14 14:15 ` Alex
  0 siblings, 2 replies; 3+ messages in thread
From: David Fifield @ 2022-06-09 22:05 UTC (permalink / raw)
  To: wireguard

I am forwarding some information about WireGuard blocking and
anti-blocking that was posted to a censorship circumvention forum.

swgp-go is a userspace obfuscation proxy that aims to hide WireGuard's
distinctive protocol fingerprint (message_type and reserved_zero fields,
fixed packet lengths). It super-encrypts part or all of WireGuard
packets using a preshared symmetric key, and optionally adds padding.
The security of the channel relies on the encryption and authentication
of the underlying WireGuard tunnel, which requires less overhead than a
general-purpose circumvention proxy would.

https://github.com/database64128/swgp-go
https://github.com/net4people/bbs/issues/117

There is a past discussion on this mailing list of something similar.
That one was in the kernel; this one is in userspace.
https://lists.zx2c4.com/pipermail/wireguard/2021-September/007142.html
https://github.com/net4people/bbs/issues/88

Separately, the swgp-go announcement post comments on the dynamics of
WireGuard blocking in China:

> The GFW will block the remote peer's UDP port for a few days after
> about a week's continuous usage.
> ...
> ... the GFW only started blocking WireGuard on IPv4 this February.

GFW = Great Firewall, the collective name for various censorship systems
used by the government of China. The pattern of "detect, then block for
a limited time, then unblock" is typical for the GFW, though the time
intervals are usually rather shorter. For example, when the GFW began to
block the use of the ESNI extension in TLS 1.3, it would block the
server endpoint for 120 or 180 seconds:
https://gfw.report/blog/gfw_esni_blocking/en/#residual-censorship

I have not confirmed the reported blocking behavior in China. It's worth
keeping in mind also that blocking in China can differ across networks
and geographic regions. I did find a Reddit post from 3 months ago, from
the Fuzhou region, saying that WireGuard is detected and blocked within
24 hours:
https://www.reddit.com/r/WireGuard/comments/t0bpy3/wireguard_detected_and_blocked_by_gfw/

A past message on this mailing list about temporary problems with the
WireGuard protocol in Russia last year:
https://lists.zx2c4.com/pipermail/wireguard/2021-September/007050.html

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: WireGuard protocol blocking in China, swgp-go (userspace obfuscation proxy)
  2022-06-09 22:05 WireGuard protocol blocking in China, swgp-go (userspace obfuscation proxy) David Fifield
@ 2022-06-14 13:13 ` Nico Schottelius
  2022-06-14 14:15 ` Alex
  1 sibling, 0 replies; 3+ messages in thread
From: Nico Schottelius @ 2022-06-14 13:13 UTC (permalink / raw)
  To: David Fifield; +Cc: wireguard


David Fifield <david@bamsoftware.com> writes:

> I am forwarding some information about WireGuard blocking and
> anti-blocking that was posted to a censorship circumvention forum.

In regards to this topic I was wondering if it makes sense to have a
more generic obfuscation proxy that can carry tcp/udp payload?

Maybe this already exists, but I would think that something that hops
protocols (IPv6, IPv4 endpoints, tcp/udp encapsolution), changes ports
and uses envelope based tunneling (http, https, smtp, imap - worst case
DNS) would make it easier to sustain communication even in more serious
filtering scenarios.

Given such a "generic obfuscator", it could be combined with "protocol"
modes, i.e. enhancing protocols such as wireguard with the presented
algorithm, making it even harder to predict the content.

I'd assume some performance regressions using such an obfuscator, but
maybe it could even "learn" the proper obfuscation by detecting blocks
on easier to detect obfuscation and then switching to a stronger, but
less efficient obfuscation.

Wondering what your thoughts are on this.

Best regards,

Nico

--
Sustainable and modern Infrastructures by ungleich.ch

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: WireGuard protocol blocking in China, swgp-go (userspace obfuscation proxy)
  2022-06-09 22:05 WireGuard protocol blocking in China, swgp-go (userspace obfuscation proxy) David Fifield
  2022-06-14 13:13 ` Nico Schottelius
@ 2022-06-14 14:15 ` Alex
  1 sibling, 0 replies; 3+ messages in thread
From: Alex @ 2022-06-14 14:15 UTC (permalink / raw)
  To: David Fifield; +Cc: wireguard

[-- Attachment #1: Type: text/plain, Size: 358 bytes --]

On Thu, 9 Jun 2022 16:05:22 -0600
David Fifield <david@bamsoftware.com> wrote:

> I am forwarding some information about WireGuard blocking and
> anti-blocking that was posted to a censorship circumvention forum.
> 

You may find this information[0] relevant and helpful.

Regards,
Alex

[0] https://realworldcrypto.files.wordpress.com/2013/06/shrimpton.pdf

[-- Attachment #2: shrimpton.pdf --]
[-- Type: application/pdf, Size: 2486747 bytes --]

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2022-06-17 11:39 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-06-09 22:05 WireGuard protocol blocking in China, swgp-go (userspace obfuscation proxy) David Fifield
2022-06-14 13:13 ` Nico Schottelius
2022-06-14 14:15 ` Alex

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).